The RSA Conference, one of the largest and most prestigious events in the cybersecurity industry, brings together top security experts, vendors, and thought leaders from around the world to discuss the latest trends, challenges, and innovations in the field. It’s one of the premier events in the industry and presents a unique moment for companies to share their expertise with an audience that knows the ins and outs of the cybersecurity trade.
One of the highlights of the RSAC is the Innovation Sandbox, a competition that showcases the most promising and innovative new security startups. Participation in the competition is a coveted opportunity, an honor that vendors prepare for and take quite seriously. It’s when the best in class can demonstrate their unique innovations, talent, and technology. This year, Valence Security was one of the finalists in the Innovation Sandbox, and Valence Co-Founder and CEO Yoni Shohet gave an exciting presentation describing our approach to SaaS security posture management (SSPM).
In this blog post, we’ll summarize Yoni’s presentation and contextualize how advanced SSPM solutions mitigate SaaS security risks.
The increasing complexity of SaaS platforms and the decentralized nature of their adoption pose significant risks to organizations. SaaS platforms are often adopted by business units or business departments without proper security oversight. This lack of centralized control makes it difficult for security teams to identify misconfigurations, increasing the risk of breaches.
Because organizations often have interlinked SaaS services across customers, which typically carry business-critical data, SaaS represents a high-value target to attackers. We’ve seen many examples where threat actors gain access to an organization’s environment through insufficiently secured SaaS services, compromise data, and disrupt operations.
And while it is widely accepted that protecting one's identity is now as important as defending a physical perimeter, security SaaS solutions have primarily centered on safeguarding human identities, while neglecting to secure non-human identities. This oversight considerably widens the scope of a security breach, as threats can easily move laterally once the weakest point of entry is compromised.
For security teams overseeing the protection of core SaaS applications, there is an urgent need to remediate risk and simultaneously automate the workflows that engage with business users.
With Valence’s SSPM solutions, organizations can remediate third-party integration, identity, misconfiguration and data sharing risks across critical SaaS applications. What’s more, seamless collaboration between security teams and business users provides unified control across multiple SaaS applications, removes the need for deep SaaS expertise, and positions security teams as business enablement champions.
As an example, Lionbridge, a Valence customer, discovered thousands of inactive third-party tokens—a significant SaaS risk. However, the customer was able to quickly remediate 95% of the risk with no additional work by the security team. Thanks to Valence's automated policy enforcement, the customer was able to continue minimizing configuration drift over time.
Results like these foster confidence and optimism across teams. By integrating a solution that continuously reduces SaaS risks—even as the SaaS mesh grows—security teams gain the tools they need to decentralize risk remediation, while accelerating SaaS adoption and helping to drive the business growth that SaaS unlocks.
---------------
Video Transcript
Slide 1:
This is Sam from marketing, who just engaged with a new automation agency.
He didn’t know who needed access to the confidential project data, so he shared it with “anyone with a link”.
Then, he onboarded one of the agency consultants, Hugh, as a Salesforce admin without corporate SSO.
Hugh then connected several high privilege third-party OAuth apps to Salesforce.
Without Valence, the security team has limited visibility into these risks.
Slide 2:
Why?
SaaS applications have evolved to become complex platforms, and they are adopted decentrally with minimal security oversight.
Any business user is now potentially an admin, empowered to automate, share, and collaborate.
Slide 3:
Remediating SaaS risks has become critical, given the rise in SaaS breaches.
From OAuth token abuse, to MFA-fatigue, and SaaS-based lateral movement.
Slide 4:
With Valence, the security team can leverage automated workflows to engage with Sam and understand the business context.
Enabling visibility, risk management, and automated remediation.
Slide 5:
Our agentless platform provides security teams with in-depth visibility into their SaaS risks including third-party integrations, data shares, users & permissions, and other misconfigurations.
But just visibility is no longer enough.
We’ve heard security teams say again and again that “If I see a problem, I need to be able to solve it”, so we built Valence to go beyond visibility and to remediate SaaS risks.
Slide 6:
Since SaaS is adopted decentrally, we need to decentralize remediation. The key: automation and collaboration.
Our automated workflows enable security teams to collaborate with the business users to remediate risks while accelerating business productivity and SaaS adoption.
This empowers business users, reduces risk and saves time for security teams.
Slide 7:
Let’s explore an actual customer’s experience with Valence.
They discovered thousands of inactive third-party tokens.
All they needed to do? Define a simple policy that engages their business users.
They remediated 95% of the risk with no additional work by the security team.
And the automated workflows continue to minimize configuration drift over time.
Slide 8:
Valence was founded by serial entrepreneurs.
We’re backed by the top companies and VCs in the security industry.
And already trusted by leading organizations worldwide.
Slide 9:
Valence
Remove the mess from your SaaS mesh
